Subject: [OAUTH-WG] OAuth 2.1: Missing token?

From: Johannes Koch <[email-masked]>
Date: Fri, 4 Feb 2022 10:15:48 +0100

Hi there,

a question about
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-04

5.2.3.  Error Codes

   "invalid_request":  The request is missing a required parameter,
      includes an unsupported parameter or parameter value, repeats the
      same parameter, uses more than one method for including an access
      token, or is otherwise malformed.  The resource server SHOULD
      respond with the HTTP 400 (Bad Request) status code.

   "invalid_token":  The access token provided is expired, revoked,
      malformed, or invalid for other reasons.  The resource SHOULD
      respond with the HTTP 401 (Unauthorized) status code.  The client
      MAY request a new access token and retry the protected resource
      request.

Now, what is the intended error code for the situation where no access
token is provided? The description for invalid_token seems to imply that
one token was provided.
As the token may be seen as a required parameter, invalid_request may be
appropriate. However, a missing token smells more like HTTP 401
(Unauthorized).

Should this be an additional error code (missing_token)? Or should this
case be added to invalid_token?

-- 
Johannes Koch

---

From: Warren Parad <[email-masked]>
Date: Fri, 4 Feb 2022 10:55:06 +0100

It may help to specifically clarify which interaction with the AS are we
talking about here.

Warren Parad

Founder, CTO
Secure your user data with IAM authorization as a service. Implement
Authress <https://authress.io/>.

On Fri, Feb 4, 2022 at 10:16 AM Johannes Koch <johannes.koch=
[email-masked]> wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Neil Madden <[email-masked]>
Date: Fri, 4 Feb 2022 10:19:59 +0000

The example at the end of section 5.2.2 suggests no error_code and just a 401/WWW-Authenticate header in this case:

 For example, in response to a protected resource request without
   authentication:

   HTTP/1.1 401 Unauthorized
   WWW-Authenticate: Bearer realm="example"

And the paragraph in section 5.2.3 immediately following the section you quote is even more explicit:

   If the request lacks any authentication information (e.g., the client
   was unaware that authentication is necessary or attempted using an
   unsupported authentication method), the resource server SHOULD NOT
   include an error code or other error information.

So, no error_code at all if no access token supplied.

Kind regards,

Neil

> On 4 Feb 2022, at 09:15, Johannes Koch <johannes.koch=[email-masked]> wrote:
> 
> 	EntSec couldn't recognize this email as this is the first time you received an email from this sender johannes.koch=40avenga.com @ dmarc.ietf.org
> 
> Hi there,
> 
> a question about https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-04 <https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-04>
> 5.2.3.  Error Codes
> 
> Now, what is the intended error code for the situation where no access token is provided? The description for invalid_token seems to imply that one token was provided.
> As the token may be seen as a required parameter, invalid_request may be appropriate. However, a missing token smells more like HTTP 401 (Unauthorized).
> 
> Should this be an additional error code (missing_token)? Or should this case be added to invalid_token?
> 
> -- 
> Johannes Koch